[PATCH bpf-next v4 2/3] bpf, xdp: move offload check into dev_xdp_install()

[Jiayuan Chen]

bpf_xdp_link_update() calls dev_xdp_install() directly and skips
dev_xdp_attach(), so the checks in dev_xdp_attach() do not run. A user can
make an XDP link with a normal program and then swap in an offloaded or
device-bound program with BPF_LINK_UPDATE, which puts it on the software
path.

Move the three program checks (offloaded, bound to another device, and
device-bound in generic mode) from dev_xdp_attach() into
dev_xdp_install(), so both the attach path and the link update path are
covered.

Fixes: 026a4c28e1db3 ("bpf, xdp: Implement LINK_UPDATE for BPF XDP link")
Signed-off-by: Jiayuan Chen <jiayuan.c...@linux.dev>
---
 net/core/dev.c | 27 +++++++++++++++------------
 1 file changed, 15 insertions(+), 12 deletions(-)

diff --git a/net/core/dev.c b/net/core/dev.c
index af260ff5462a..3281f226c1e5 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -10329,6 +10329,21 @@ static int dev_xdp_install(struct net_device *dev, 
enum bpf_xdp_mode mode,
 
        netdev_assert_locked_ops_compat(dev);
 
+       if (prog) {
+               if (mode != XDP_MODE_HW && bpf_prog_is_offloaded(prog->aux)) {
+                       NL_SET_ERR_MSG(extack, "Using offloaded program without 
HW_MODE flag is not supported");
+                       return -EINVAL;
+               }
+               if (bpf_prog_is_dev_bound(prog->aux) && 
!bpf_offload_dev_match(prog, dev)) {
+                       NL_SET_ERR_MSG(extack, "Program bound to different 
device");
+                       return -EINVAL;
+               }
+               if (bpf_prog_is_dev_bound(prog->aux) && mode == XDP_MODE_SKB) {
+                       NL_SET_ERR_MSG(extack, "Can't attach device-bound 
programs in generic mode");
+                       return -EINVAL;
+               }
+       }
+
        if (dev->cfg->hds_config == ETHTOOL_TCP_DATA_SPLIT_ENABLED &&
            prog && !prog->aux->xdp_has_frags) {
                NL_SET_ERR_MSG(extack, "unable to install XDP to device using 
tcp-data-split");
@@ -10480,18 +10495,6 @@ static int dev_xdp_attach(struct net_device *dev, 
struct netlink_ext_ack *extack
                        NL_SET_ERR_MSG(extack, "Native and generic XDP can't be 
active at the same time");
                        return -EEXIST;
                }
-               if (!offload && bpf_prog_is_offloaded(new_prog->aux)) {
-                       NL_SET_ERR_MSG(extack, "Using offloaded program without 
HW_MODE flag is not supported");
-                       return -EINVAL;
-               }
-               if (bpf_prog_is_dev_bound(new_prog->aux) && 
!bpf_offload_dev_match(new_prog, dev)) {
-                       NL_SET_ERR_MSG(extack, "Program bound to different 
device");
-                       return -EINVAL;
-               }
-               if (bpf_prog_is_dev_bound(new_prog->aux) && mode == 
XDP_MODE_SKB) {
-                       NL_SET_ERR_MSG(extack, "Can't attach device-bound 
programs in generic mode");
-                       return -EINVAL;
-               }
                if (new_prog->expected_attach_type == BPF_XDP_DEVMAP) {
                        NL_SET_ERR_MSG(extack, "BPF_XDP_DEVMAP programs can not 
be attached to a device");
                        return -EINVAL;
-- 
2.43.0